Commit Graph

766977 Commits

Author SHA1 Message Date
Boyuan Zhang
e612bcc3ab drm/amdgpu: set jpeg ring functions
Set all vcn jpeg ring function pointers.

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:35 -05:00
Boyuan Zhang
221f36c460 drm/amdgpu: implement jpeg ring functions
Implement all ring functions needed for jpeg ring

v2: remove unnecessary mem read function.

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:35 -05:00
Boyuan Zhang
50613395ab drm/amdgpu: add more jpeg register offset headers
Add more jpeg registers defines that are needed for jpeg ring functions

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:35 -05:00
Boyuan Zhang
d521093a5f drm/amdgpu: add jpeg packet defines to soc15d.h
Add new packet for vcn jpeg, including condition checks, types and packet

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:34 -05:00
Boyuan Zhang
fa3087f768 drm/amdgpu: add vcn jpeg ring
Add jpeg to amdgpu_vcn

v2: remove unnecessary scheduler entity

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:34 -05:00
Boyuan Zhang
8e0fce5a96 drm/amdgpu: define vcn jpeg ring
Add AMDGPU_RING_TYPE_VCN_JPEG ring define

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:34 -05:00
Andrey Grodzovsky
48ad368a8a drm/amdgpu: move amdgpu_ctx_mgr_entity_fini to f_ops flush hook (V4)
With this we can now terminate jobs enqueue into SW queue the moment
the task is being killed instead of waiting for last user of
drm file to release it.

Also stop checking for kref_read(&ctx->refcount) == 1 when
calling drm_sched_entity_do_release since other task
might still hold a reference to this entity but we don't
care since KILL means terminate job submission regardless
of what other tasks are doing.

v2:
Use returned remaining timeout as parameter for the next call.
Rebase.

v3:
Switch to working with jiffies.
Streamline remainder TO usage.
Rebase.

v4:
Rebase.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:33 -05:00
Andrey Grodzovsky
741f01e636 drm/scheduler: Avoid using wait_event_killable for dying process (V4)
Dying process might be blocked from receiving any more signals
so avoid using it.

Also retire enity->fini_status and just check the SW queue,
if it's not empty do the fallback cleanup.

Also handle entity->last_scheduled == NULL use case which
happens when HW ring is already hangged whem a  new entity
tried to enqeue jobs.

v2:
Return the remaining timeout and use that as parameter for the next call.
This way when we need to cleanup multiple queues we don't wait for the
entire TO period for each queue but rather in total.
Styling comments.
Rebase.

v3:
Update types from unsigned to long.
Work with jiffies instead of ms.
Return 0 when TO expires.
Rebase.

v4:
Remove unnecessary timeout calculation.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:33 -05:00
Michel Dänzer
a2d19d66b1 drm/amdgpu: Hook up amdgpu_object.c documentation
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:33 -05:00
Michel Dänzer
2472e11b85 drm/amdgpu: Fix-ups for amdgpu_object.c documentation
* Fix format of return value descriptions
* Document all parameters of amdgpu_bo_free_kernel
* Document amdgpu_bo_get_preferred_pin_domain

Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:32 -05:00
Michel Dänzer
0152ac1652 drm/amdgpu: Hook up documentation about memory domains
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:32 -05:00
Shirish S
8f4805a265 drm/amdgpu: avoid sleep while executing atombios table (V2)
This patch replaces kzalloc's flag from GFP_KERNEL to
GFP_ATOMIC to avoid sleeping in atomic context.

Below is the stack trace:

BUG: sleeping function called from invalid context at mm/slab.h:***
in_atomic(): 1, irqs_disabled(): 0, pid: 1137, name: DrmThread
CPU: 1 PID: 1137 Comm: DrmThread Tainted: G        W       4.14.43 #10
Call Trace:
 dump_stack+0x4d/0x63
 ___might_sleep+0x11f/0x12e
 __kmalloc+0x76/0x126
 amdgpu_atom_execute_table_locked+0xfc/0x285
 amdgpu_atom_execute_table+0x5d/0x72
 transmitter_control_v1_5+0xef/0x11a
 hwss_edp_backlight_control+0x132/0x151
 dce110_disable_stream+0x133/0x16e
 core_link_disable_stream+0x1c5/0x23b
 dce110_reset_hw_ctx_wrap+0xb4/0x1aa
 dce110_apply_ctx_to_hw+0x4e/0x6da
 ? generic_reg_get+0x1f/0x33
 dc_commit_state+0x33f/0x3d2
 amdgpu_dm_atomic_commit_tail+0x2cf/0x5d2
 ? wait_for_common+0x5b/0x69
 commit_tail+0x42/0x64
 drm_atomic_helper_commit+0xdc/0xf9
 drm_atomic_helper_set_config+0x5c/0x76
 __drm_mode_set_config_internal+0x64/0x105
 drm_mode_setcrtc+0x474/0x56f
 ? drm_mode_getcrtc+0x155/0x155
 drm_ioctl_kernel+0x6c/0xa8
 drm_ioctl+0x267/0x353
 ? drm_mode_getcrtc+0x155/0x155
 amdgpu_drm_ioctl+0x4f/0x7f
 vfs_ioctl+0x21/0x2f
 do_vfs_ioctl+0x4c4/0x4e7
 ? security_file_ioctl+0x3b/0x4f
 SyS_ioctl+0x57/0x79
 do_syscall_64+0x64/0x72
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2

V2: Added stack trace in commit message.

Signed-off-by: Shirish S <shirish.s@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:31 -05:00
Michel Dänzer
baca30fabd drm/amdgpu: Add documentation for PRIME related code
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:31 -05:00
Michel Dänzer
99fa7ce3a8 drm/doc: Add initial amdgpu driver documentation
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:31 -05:00
Michel Dänzer
41f507080e drm/doc: Add a label for the PRIME Buffer Sharing chapter
So that it can be referenced from e.g. DOC comments.

Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:30 -05:00
Alex Deucher
3120e2a390 drm/amdgpu/pp: switch the default dpm implementation for CI
Switch hawaii and bonaire to use powerplay rather than the old
dpm implementation.  Powerplay supports more features and is
better maintained.  Ultimately, we can drop the older dpm
implementation like we did for other older asics.

Reviewed-by: Huang Rui <ray.huang@amd.com>
Reviewed-by: Rex Zhu <rezhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:30 -05:00
Alex Deucher
d1a9146b3a drm/amdgpu/display: enable CONFIG_DRM_AMD_DC_DCN1_0 by default
It's required for displays on Raven.  The DCN bandwidth calcs use
floating point, but DCN is APU only and it already depends on
X86.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:30 -05:00
Alex Deucher
5099114ba3 drm/amdgpu/display: drop DRM_AMD_DC_FBC kconfig option
Just enable it always.  This was leftover from feature
bring up.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:29 -05:00
Samuel Li
b646c1dc83 drm/amdgpu: add kernel doc for memory domains.
Document the GEM domains exposed to userspace.

Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Samuel Li <Samuel.Li@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:29 -05:00
Samuel Li
6f4e8d6e59 drm/amdgpu: add kernel doc for amdgpu_object.c
Document the amdgpu buffer object API.

v2: Add a DOC section and some more clarification.
v3: Add some clarification and fix a spelling.

Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Samuel Li <Samuel.Li@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:28 -05:00
Tony Cheng
0ce55b4676 drm/amd/display: dal 3.1.47
Signed-off-by: Tony Cheng <tony.cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:28 -05:00
Dmytro Laktyushkin
0dd6cfe15c drm/amd/display: add dentist frequency to resource pool
Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:28 -05:00
Eric Bernstein
0b126112e9 drm/amd/display: DP YCbCr 4:2:0 support
Update MSA MISC1 bit 6 programming to handle YCbCr 4:2:0
and BT2020 cases.

Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:27 -05:00
Reza Amini
8de94233f4 drm/amd/display: Prefix TIMING_STANDARD entries with DC_
Signed-off-by: Reza Amini <Reza.Amini@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:27 -05:00
Tony Cheng
e0d4234982 drm/amd/display: dal 3.1.46
Signed-off-by: Tony Cheng <tony.cheng@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:27 -05:00
Yasir Al Shekerchi
a27f199677 drm/amd/display: Added documentation for some DC interface functions
Signed-off-by: Yasir Al Shekerchi <YasirAl.Shekerchi@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:26 -05:00
Vitaly Prosyak
43610a9be1 drm/amd/display: HLG support
Low level calculation methods.

Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:26 -05:00
Anthony Koo
1a05873f21 drm/amd/display: Refactor audio programming
Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:26 -05:00
Krunoslav Kovac
4ea209073d drm/amd/display: Dynamic HDR metadata mem buffer
Basic framework:
- caps for reporting dynamic HDR metadata support
- allocation of frame buffer memory and storage

Signed-off-by: Krunoslav Kovac <Krunoslav.Kovac@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:25 -05:00
Nikola Cornij
3c8e4316a0 drm/amd/display: Optimize DP_SINK_STATUS_ESI range read on HPD
DP_SINK_STATUS_ESI range data is not continual, but rather than
getting it in two AUX reads, it's quicker to read more bytes in a
AUX read and then memcpy the required fields (it's only 8 more
bytes to read).

Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:25 -05:00
Aric Cyr
bf58968647 drm/amd/display: Default log masks should include all connectivity events
Signed-off-by: Aric Cyr <aric.cyr@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:25 -05:00
Hersen Wu
cb1d7eacb5 drm/amd/display: Fix indentation in dcn10 resource constructor
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:24 -05:00
Anthony Koo
8ca8090085 drm/amd/display: add DPCD read for Sink ieee OUI
Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:24 -05:00
Eric Bernstein
0f6ca3bac4 drm/amd/display: Add function to get optc active size
Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:24 -05:00
Hersen Wu
73770ca53f drm/amd/display: AUX will exit when HPD LOW detected
This change shorten wait time when HPD LOW. With HPD LOW, without this
change, AUX routine delay is 450us. With this change, it is 42us.

Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:23 -05:00
Anthony Koo
f9430b235d drm/amd/display: Prefix event prints with ==Event==
Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:23 -05:00
Tony Cheng
ae2389e0fc drm/amd/display: dal 3.1.45
Signed-off-by: Tony Cheng <tony.cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:23 -05:00
Dmytro Laktyushkin
9a08f51fa7 drm/amd/display: upgrade scaler math
This change will allow the viewport overlap to apply to rotated/
mirrored surfaces. Viewport overlap results in extra pixels being
added to viewport allowing the first few pixels to be scaled as
if there is no cut-off(mpo or pipe split) and allows us to get matching
crc's between scaled split and unsplit outputs of the same thing.

Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:22 -05:00
Charlene Liu
66e48cd371 drm/amd/display: Clean up submit_channel_request
Signed-off-by: Charlene Liu <charlene.liu@amd.com>
Reviewed-by: Vitaly Prosyak <Vitaly.Prosyak@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:22 -05:00
Eric Bernstein
ea4a202053 drm/amd/display: pass pipe_ctx straight to blank_pixel_data
Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:21 -05:00
Nayan Deshmukh
677e8622a9 drm/doc: add a chapter for gpu scheduler
Signed-off-by: Nayan Deshmukh <nayan26deshmukh@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 12:20:21 -05:00
Nayan Deshmukh
2d33948e4e drm/scheduler: add documentation
convert existing raw comments into kernel-doc format as well
as add new documentation

v2: reword the overview

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Nayan Deshmukh <nayan26deshmukh@gmail.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
2018-06-15 12:20:21 -05:00
Gustavo A. R. Silva
fe78627d43 drm/amd/display: fix type of variable
Currently, the maximum value that *counter* can reach is 255, and
code at line 150: while (counter < 1000) { implies a bigger value
could be expected.

Fix this by changing the type of variable *counter* from uint8_t
to uint16_t.

Addresses-Coverity-ID: 1470030 ("Operands don't affect result")
Fixes: 2b6199a1d1 ("drm/amd/display: replace msleep with udelay in fbc path")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-06-15 11:47:15 -05:00
Jose Abreu
7cfde0af73 net: stmmac: Run HWIF Quirks after getting HW caps
Currently we were running HWIF quirks before getting HW capabilities.
This is not right because some HWIF callbacks depend on HW caps.

Lets save the quirks callback and use it in a later stage.

This fixes Altera socfpga.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Fixes: 5f0456b431 ("net: stmmac: Implement logic to automatically select HW Interface")
Reported-by: Dinh Nguyen <dinh.linux@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: Vitor Soares <soares@synopsys.com>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Cc: Dinh Nguyen <dinh.linux@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:38:52 -07:00
Roopa Prabhu
f6a6f203d5 neighbour: skip NTF_EXT_LEARNED entries during forced gc
Commit 9ce33e4653 ("neighbour: support for NTF_EXT_LEARNED flag")
added support for NTF_EXT_LEARNED for neighbour entries.
NTF_EXT_LEARNED entries are neigh entries managed by control
plane (eg: Ethernet VPN implementation in FRR routing suite).
Periodic gc already excludes these entries. This patch extends
it to forced gc which the earlier patch missed.

Fixes: 9ce33e4653 ("neighbour: support for NTF_EXT_LEARNED flag")
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:37:33 -07:00
Zhouyang Jia
7c099773b0 net: cxgb3: add error handling for sysfs_create_group
When sysfs_create_group fails, the lack of error-handling code may
cause unexpected results.

This patch adds error-handling code after calling sysfs_create_group.

Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:15:24 -07:00
David S. Miller
c14a0246bd Merge branch 'tls-fixes'
Daniel Borkmann says:

====================
Two tls fixes

First one is syzkaller trigered uaf and second one noticed
while writing test code with tls ulp. For details please see
individual patches.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:14:31 -07:00
Daniel Borkmann
06030dbaf3 tls: fix waitall behavior in tls_sw_recvmsg
Current behavior in tls_sw_recvmsg() is to wait for incoming tls
messages and copy up to exactly len bytes of data that the user
provided. This is problematic in the sense that i) if no packet
is currently queued in strparser we keep waiting until one has been
processed and pushed into tls receive layer for tls_wait_data() to
wake up and push the decrypted bits to user space. Given after
tls decryption, we're back at streaming data, use sock_rcvlowat()
hint from tcp socket instead. Retain current behavior with MSG_WAITALL
flag and otherwise use the hint target for breaking the loop and
returning to application. This is done if currently no ctx->recv_pkt
is ready, otherwise continue to process it from our strparser
backlog.

Fixes: c46234ebb4 ("tls: RX path for ktls")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:14:30 -07:00
Daniel Borkmann
a447da7d00 tls: fix use-after-free in tls_push_record
syzkaller managed to trigger a use-after-free in tls like the
following:

  BUG: KASAN: use-after-free in tls_push_record.constprop.15+0x6a2/0x810 [tls]
  Write of size 1 at addr ffff88037aa08000 by task a.out/2317

  CPU: 3 PID: 2317 Comm: a.out Not tainted 4.17.0+ #144
  Hardware name: LENOVO 20FBCTO1WW/20FBCTO1WW, BIOS N1FET47W (1.21 ) 11/28/2016
  Call Trace:
   dump_stack+0x71/0xab
   print_address_description+0x6a/0x280
   kasan_report+0x258/0x380
   ? tls_push_record.constprop.15+0x6a2/0x810 [tls]
   tls_push_record.constprop.15+0x6a2/0x810 [tls]
   tls_sw_push_pending_record+0x2e/0x40 [tls]
   tls_sk_proto_close+0x3fe/0x710 [tls]
   ? tcp_check_oom+0x4c0/0x4c0
   ? tls_write_space+0x260/0x260 [tls]
   ? kmem_cache_free+0x88/0x1f0
   inet_release+0xd6/0x1b0
   __sock_release+0xc0/0x240
   sock_close+0x11/0x20
   __fput+0x22d/0x660
   task_work_run+0x114/0x1a0
   do_exit+0x71a/0x2780
   ? mm_update_next_owner+0x650/0x650
   ? handle_mm_fault+0x2f5/0x5f0
   ? __do_page_fault+0x44f/0xa50
   ? mm_fault_error+0x2d0/0x2d0
   do_group_exit+0xde/0x300
   __x64_sys_exit_group+0x3a/0x50
   do_syscall_64+0x9a/0x300
   ? page_fault+0x8/0x30
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

This happened through fault injection where aead_req allocation in
tls_do_encryption() eventually failed and we returned -ENOMEM from
the function. Turns out that the use-after-free is triggered from
tls_sw_sendmsg() in the second tls_push_record(). The error then
triggers a jump to waiting for memory in sk_stream_wait_memory()
resp. returning immediately in case of MSG_DONTWAIT. What follows is
the trim_both_sgl(sk, orig_size), which drops elements from the sg
list added via tls_sw_sendmsg(). Now the use-after-free gets triggered
when the socket is being closed, where tls_sk_proto_close() callback
is invoked. The tls_complete_pending_work() will figure that there's
a pending closed tls record to be flushed and thus calls into the
tls_push_pending_closed_record() from there. ctx->push_pending_record()
is called from the latter, which is the tls_sw_push_pending_record()
from sw path. This again calls into tls_push_record(). And here the
tls_fill_prepend() will panic since the buffer address has been freed
earlier via trim_both_sgl(). One way to fix it is to move the aead
request allocation out of tls_do_encryption() early into tls_push_record().
This means we don't prep the tls header and advance state to the
TLS_PENDING_CLOSED_RECORD before allocation which could potentially
fail happened. That fixes the issue on my side.

Fixes: 3c4d755915 ("tls: kernel TLS support")
Reported-by: syzbot+5c74af81c547738e1684@syzkaller.appspotmail.com
Reported-by: syzbot+709f2810a6a05f11d4d3@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:14:30 -07:00
David S. Miller
695ad876d0 Merge branch 'l2tp-l2tp_ppp-must-ignore-non-PPP-sessions'
Guillaume Nault says:

====================
l2tp: l2tp_ppp must ignore non-PPP sessions

The original L2TP code was written for version 2 of the protocol, which
could only carry PPP sessions. Then L2TPv3 generalised the protocol so that
it could transport different kinds of pseudo-wires. But parts of the
l2tp_ppp module still break in presence of non-PPP sessions.

Assuming L2TPv2 tunnels can only transport PPP sessions is right, but
l2tp_netlink failed to ensure that (fixed in patch 1).
When retrieving a session from an arbitrary tunnel, l2tp_ppp needs to
filter out non-PPP sessions (last occurrence fixed in patch 2).
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:12:37 -07:00